- syslog-ng - lists.balabit.hu

Solaris 10: Insufficient buffer space for retrieving STREAMS log message
by AndyH＠nominet.org.uk 18 Dec '07

18 Dec '07

Hi, I'm running the latest version compiled on Solaris 10 It runs ok for a while but then I get this: syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log message; res='2' and then nothing new logs apart from the "-- MARK --" lines I've seen a couple of references to this problem here https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html but the patches mentioned are all now in the downloaded src. Is there any other reason for this behaviour? Regards Andy

2 3

Getting "--MARK--" in the generated logs----Please REPLY soon
by ROHIT SAXENA 17 Dec '07

17 Dec '07

Hi All, Since last three days I m getting the logs as follows: Dec 17 02:37:35 src@inoc-cabin3-17 -- MARK -- Dec 17 02:57:35 src@inoc-cabin3-17 -- MARK -- Dec 17 03:17:35 src@inoc-cabin3-17 -- MARK -- Dec 17 03:37:35 src@inoc-cabin3-17 -- MARK -- Dec 17 03:57:35 src@inoc-cabin3-17 -- MARK -- Dec 17 04:17:35 src@inoc-cabin3-17 -- MARK -- Dec 17 04:37:35 src@inoc-cabin3-17 -- MARK -- Dec 17 04:57:35 src@inoc-cabin3-17 -- MARK -- Dec 17 05:17:35 src@inoc-cabin3-17 -- MARK -- Dec 17 05:37:35 src@inoc-cabin3-17 -- MARK -- Can any one please let me know the reasons why this is happening????? I m attaching the file syslog-ng.conf configuration file.....Please check it and inform me.... "Faliure is not getting knocked down, it's not getting up again" --------------------------------- 5, 50, 500, 5000 - Store N number of mails in your inbox. Click here.

2 1

Cisco Catalyst switches
by Charles Mattair 17 Dec '07

17 Dec '07

We've recently started getting traffic from catalyst switches and it doesn't parse well. The start of a message looks like: 445750: Dec 14 11:23:27: %SW_MATM-4-MACFLAP_NOTIF: Host 0201.0000.0000 in v... The event id (445750) looks like a program id (the parser sees everything else as missing) and the date becomes part of the message text. Are there any plans to "teach" the parser to recognize this format? We noticed it recognizes PIX formats with a colon following the date so it doesn't seem too out of line. If there aren't, we'll generate mods and submit them. tnx

3 2

ZSA-2007-029: syslog-ng Denial of Service
by Balazs Scheidler 17 Dec '07

17 Dec '07

-------- Z o r p S e c u r i t y A d v i s o r y ( Z S A ) ------------ PACKAGE : syslog-ng, syslog-ng-premium-edition AFFECTED VERSION : <= 2.0.6, 2.1.8 FIXED : 2.0.6, 2.1.8 SUMMARY : Denial of Service TYPE : remote AFFECTED : all platforms ZSA-ID : ZSA-2007-029 DATE : Dec 14, 2007 ----------------------------------------------------------------------------- DESCRIPTION: Oriol Carreras has discovered a security vulnerability in syslog-ng, the multi-platform syslog-replacement application developed by BalaBit IT Security. BACKGROUND: Earlier versions of syslog-ng Open Source Edition and syslog-ng Premium Edition were vulnerable to a possible Denial of Service. The latest release (2.0.6 for syslog-ng, 2.1.8 for syslog-ng Premium Edition) fixes a segmentation fault which occurred when the timestamp of the incoming messages did not end with a space character (NULL pointer dereference). This is an easy Denial of Service possibility. Apart from the Denial of Service, no further exploits are known to be possible. FURTHER INFORMATION For further information on syslog-ng, visit http://www.balabit.com/network-security/syslog-ng/ or download the documentation of syslog-ng from http://www.balabit.com/support/documentation/ SOLUTION: We recommend that you update the affected packages immediately, or apply the patch referenced below: http://git.balabit.hu/?p=bazsi/syslog-ng-2.0.git;a=commitdiff;h=3126ebad217… DOWNLOAD: If you are a syslog-ng Open Source Edition user, download the source of the latest release from: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ If you are a syslog-ng Premium Edition user, or have binary subscription for syslog-ng Open Source Edition, download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 1

Kevin Gorski/IS/NEU is out of the office.
by K.Gorski＠neu.edu 17 Dec '07

17 Dec '07

I will be out of the office starting 12/17/2007 and will not return until 01/02/2008. I will respond to your message when I return from vacation.

1 0

Noob Question
by Chuck 15 Dec '07

15 Dec '07

I used this product a long time ago and it looks like its come a long way. I had one question - I want to deploy syslog-ng on my syslog box and then have all my other servers send standarad syslog message to it remotely (my enviornment in a mix of rhel 4, rhel 5, solaris 10, and sles 9) Can syslog-ng parse the standard syslog messages and route them to individual files per server w/o adding syslog-ng itself to the client systems? (otherwise leavfe syslogd intact on all my servers except the syslog box itself) Thanks, Chuck

3 2

Loss of messages: what is the limits ?
by FILEUX arnaud 13 Dec '07

13 Dec '07

Dear all, I realized some bench tests in order to determine the limits supported in tcp connection with a syslog-ng (client/server mode) and what is the optimal configuration (buffer size,etc..). My setup is as follows: 2 syslog-ng (client A - server B) on dedicated servers with 8Go RAM and quadripro CPU. Client A is configured as follow: destination to_serverB { tcp("x.x.x.x" port(1999)); }; destination to_clientA { file("/var/log/syslog-ng.log"); }; Server B: destination all { file("/var/log/syslog-ng.log"); }; On the client A i have a a C program (named stressyslog) who send send 10.000 to 500.000 messages on 10 to 100 threads and the delay between sending is 1ms to 10 ms to Client A with : syslog(LOG_NOTICE, "go %d pThread for %d messages and %d ms", iThreads, iMessages, iDelay); I make a diff between clientA and serverB and i lose some lines on ServerB (delai less than 5ms and thread greater than 50) example: delay: 2ms ; messages: 50000; thread 100; Server B has 4947888 lines in syslog-ng.log Client A has 5000087 lines in syslog-ng.log Another problem is syslog-ng never alert if some line are lost beteween Client A and Server B. I have tried to increase the buffer size (10.000 and 100.000) but the same problem. If someone can help me i would be graceful. arnaud _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail http://mail.yahoo.fr

3 2

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : EricSavidan/France/Equant is out of the office. : Lossof messages: what is thelimits ?
by eric.savidan＠orange-ftgroup.com 12 Dec '07

12 Dec '07

I will be out of the office starting 12/12/2007 and will not return until 13/12/2007.

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : Lossof messages: what is the limits ?
by eric.savidan＠orange-ftgroup.com 12 Dec '07

12 Dec '07

I will be out of the office starting 12/12/2007 and will not return until 13/12/2007.

1 0

Eric Savidan/France/Equant is out of the office. : Loss of messages: what is the limits ?
by eric.savidan＠orange-ftgroup.com 12 Dec '07

12 Dec '07

I will be out of the office starting 12/12/2007 and will not return until 13/12/2007.

1 0

Re: [syslog-ng] December 79% OFF
by VIAGRA � Official Site 10 Dec '07

10 Dec '07

1 0

Patch for following logfiles
by Charles G Waldman 10 Dec '07

10 Dec '07

Sirs: Several months ago I submitted the following patch to syslog-ng, which makes the "file" source work even if the file is not present when syslog-ng starts up. (Consider the scenario where syslog-ng starts up before some other service which logs to a file, and that file has not yet been created yet.) This patch causes syslog-ng to treat the transition from "nonexistent" to "existent" the same as if the file were moved/renamed. We are using the patched version of syslog-ng in our project and find this modification helpful. It is a very non-intrusive change, and I cannot see any negative side-effects. I would like to know if there is any chance for this patch to be incorporated into the official distribution. Thanks for your consideration. Charles G Waldman High-Energy Physics University of Chicago cgw(a)hep.uchicago.edu Patch: (also available as http://repo.mwt2.org/viewvc/patches/syslog-ng-file-source.patch ) --- syslog-ng-2.0.4/src/affile.c 2007-04-19 14:37:16.000000000 -0500 +++ syslog-ng-2.0.4-cgw2/src/affile.c 2007-06-07 11:41:00.000000000 -0500 @@ -134,7 +134,7 @@ gint fd; msg_verbose("Follow-mode file source moved, tracking of the new file is started", - evt_tag_str("file", self->filename->str), + evt_tag_str("filename", self->filename->str), NULL); log_pipe_deinit(self->reader, NULL, NULL); @@ -170,14 +170,26 @@ { AFFileSourceDriver *self = (AFFileSourceDriver *) s; gint fd; + gboolean file_opened, open_deferred=FALSE; log_reader_options_init(&self->reader_options, cfg); - if (affile_sd_open_file(self, &fd)) + file_opened = affile_sd_open_file(self, &fd); + + if (!file_opened && self->reader_options.follow_freq > 0) + { + msg_info("Follow-mode file source not found, deferring open", + evt_tag_str("filename", self->filename->str), + NULL); + open_deferred = TRUE; + fd = -1; + } + + if (file_opened || open_deferred) { self->reader = log_reader_new(fd_read_new(fd, 0), LR_LOCAL | LR_NOMREAD, s, &self->reader_options); - if (persist) + if (persist && file_opened) { gchar *str; off_t cur_pos; --- syslog-ng-2.0.4/src/logreader.c 2007-04-20 15:11:07.000000000 -0500 +++ syslog-ng-2.0.4-cgw2/src/logreader.c 2007-06-07 11:26:12.000000000 -0500 @@ -100,29 +100,32 @@ struct stat st, followed_st; off_t pos; - pos = lseek(self->fd->fd, 0, SEEK_CUR); - if (pos == (off_t) -1) - { - msg_error("Error invoking seek on followed file", - evt_tag_errno("error", errno), - NULL); - return FALSE; - } - - if (fstat(self->fd->fd, &st) < 0) - { - msg_error("Error invoking fstat() on followed file", - evt_tag_errno("error", errno), - NULL); - return FALSE; - } + if (self->fd->fd >= 0) + { + pos = lseek(self->fd->fd, 0, SEEK_CUR); + if (pos == (off_t) -1) + { + msg_error("Error invoking seek on followed file", + evt_tag_errno("error", errno), + NULL); + return FALSE; + } + + if (fstat(self->fd->fd, &st) < 0) + { + msg_error("Error invoking fstat() on followed file", + evt_tag_errno("error", errno), + NULL); + return FALSE; + } - if (pos < st.st_size) - return TRUE; + if (pos < st.st_size) + return TRUE; + } if (self->reader->options->follow_filename && stat(self->reader->options->follow_filename, &followed_st) != -1) { - if (st.st_ino != followed_st.st_ino) + if (self->fd->fd < 0 || st.st_ino != followed_st.st_ino) { /* file was moved and we are at EOF, follow the new file */ log_pipe_notify(self->reader->control, &self->reader->super.super, NC_FILE_MOVED, self);

5 8

Please help.........Its very URGENT-----Output logs contains double line for each process
by Rohit Saxena 10 Dec '07

10 Dec '07

Hi, I m getting the logs according the Hostname.....but there is a problem...I m getting two lines for every process in the logs... Following is the example for the same...... Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: Shutting down NFS services: succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: Shutting down NFS services: succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: Starting NFS services: succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: Starting NFS services: succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: rpc.rquotad startup succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: rpc.rquotad startup succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfsd[8005]: nfssvc_versbits: +2 +3 +4 Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfsd[8005]: nfssvc_versbits: +2 +3 +4 Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: rpc.nfsd startup succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: rpc.nfsd startup succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: rpc.mountd startup succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c nfs: rpc.mountd startup succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c rpcidmapd: rpc.idmapd -SIGHUP succeeded Dec 8 19:09:10 nic-761c892613c/nic-761c892613c rpcidmapd: rpc.idmapd -SIGHUP succeeded Please check the above output and suggest me the changes to be made in the syslog-ng.conf file so as to get the proper output of the log....... _________________________________________________________________ Post free property ads on Yello Classifieds now! www.yello.in http://ss1.richmedia.in/recurl.asp?pid=221

3 2

missing logs when SIGHUP
by Martin Ervius 05 Dec '07

05 Dec '07

Hi, It seems that sometimes when syslog-ng receives a SIGHUP (like for example after logrotating or config change) it loses track of the logs that has been received, but are not yet written to disk. Except for this problem, syslog-ng can receive ~35000 logs/sec on the same machine without any loss at all. I have been able to reproduce the situation in a test environment on both FreeBSD 6.1 (Opteron) with syslog-ng 2.0.3 and on Ubuntu Linux 7.10 (i386) with syslog-ng 2.0.5. On linux, it appears that the number of logs lost equals the size of the log_fetch_limit parameter, because the number of lost logs are in multiples of this value. To see what happens I used strace to follow syslog-ng and dump read and write calls while sending numbered logs at a rate of 1000/sec. Only one machine was sending logs and they were transferred from a different machine over tcp. During this time I sent a SIGHUP to the receiving syslog with two seconds apart (since it doesn't occur with every SIGHUP). log_fetch_limit is set to 100, log_fifo_size to 51200 and log_msg_size is 2048. Flow-control is not activated since it didn't appear to make any difference in this particular case. This is the output of 'strace -s 65536 -e write,read' with the irrelevant parts omitted (I captured a similar output on FreeBSD with ktrace, but is not included in this mail) ## read from tcp socket (only beginning and end to save space) read(5, "<135>Nov 27 18:36:34 tiger logger: hejsan 9388\n<135>Nov 27 18:36:34 tiger logger: hejsan 9389\n<135>Nov 27 18:36:34 tiger logger: hejsan 9390\n<135>Nov 27 18:36:34 tiger logger: hejsan 9391\n<135>Nov 27 18:36:34 tiger logger: hejsan 9392\n<135>Nov 27 18:36:34 tiger logger: hejsan 9393\n<135>Nov 27 18:36:34 tiger logger: hejsan 9394\n<135>Nov 27 18:36:34 tiger logger: hejsan 9395\n<135>Nov 27 18:36:34 tiger logger: hejsan 9396\n<135>Nov 27 18:36:34 tiger logger: hejsan 9397\n<135>Nov 27 18:36:34 tiger logger: hejsan 9398\n<135>Nov 27 18:36:34 tiger logger: hejsan 9399\n<135>Nov 27 18:36:34 tiger logger: hejsan 9400\n<135>Nov 27 18:36:34 tiger logger: hejsan 9401\n<135>Nov 27 18:36:34 tiger logger: hejsan 9402\n<135>Nov 27 18:36:34 tiger logger: hejsan 9403\n<135>Nov 27 18:36:34 tiger logger: hejsan 9404\n<135>Nov 27 18:36:34 tiger logger: hejsan 9405\n<135>Nov 27 18:36:34 tiger logger: hejsan 9406\n<135>Nov 27 18:36:34 tiger logger: hejsan 9407\n<135>Nov 27 18:36:34 tiger logger: hejsan 9408\n<135>Nov 27 18:36:34 tiger logger: hejsan 9409\n<135>Nov 27 18:36:34 tiger logger: hejsan 9410\n . . . <135>Nov 27 18:36:34 tiger logger: hejsan 9504\n<135>Nov 27 18:36:34 tiger logger: hejsan 9505\n<135>Nov 27 18:36:3 4 tiger logger: hejsan 9506\n<135>Nov 27 18:36:34 tiger logger: hejsan 9507\n<135>Nov 27 18:36:34 tiger logger: hej ", 8192) = 5678 ## then follows all the writes until a SIGHUP is received ... write(6, "Nov 27 18:36:34 tiger logger: hejsan 9401\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9402\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9403\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9404\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9405\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9406\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9407\n", 42) = 42 write(6, "Nov 27 18:36:34 tiger logger: hejsan 9408\n", 42) = 42 --- SIGHUP (Hangup) @ 0 (0) --- ## After the config file is re-read, syslog-ng continues to read new logs from the socket, with unwritten logs from 9409 to 9507 in the buffer (9508 is partly read before the SIGHUP) read(5, "san 9508\n<135>Nov 27 18:36:34 tiger logger: hejsan 9509\n<135>Nov 27 18:36:34 tiger logger: hejsan 9510\n<135>Nov 27 18:36:34 tiger logger: hejsan 9511\n<135>Nov 27 18:36:34 tiger logger: hejsan 9512\n<135>Nov 27 18:36:34 tiger logger: hejsan 9513\n<135>Nov 27 18:36:34 tiger logger: hejsan 9514\n<135>Nov 27 18:36:34 tiger logger: hejsan 9515\n.... ## And finally new writes are done, but starting at 9508. The logs ranging from 9409 to 9507 are now lost and are consequently missing in the destination file. write(4, "Nov 27 18:36:34 tiger logger: hejsan 9508\n", 42) = 42 write(4, "Nov 27 18:36:34 tiger logger: hejsan 9509\n", 42) = 42 write(4, "Nov 27 18:36:34 tiger logger: hejsan 9510\n", 42) = 42 write(4, "Nov 27 18:36:34 tiger logger: hejsan 9511\n", 42) = 42 ----------------------------------------------------------------------------------------- I have experimented with different parameter settings, but am still losing logs at SIGHUP. I hope this information is enough if someone is able to diagnose the issue. If not, I can send my particular config etc on request. Any input on this is appreciated, has anyone else noticed this behaviour or is it maybe a configuration issue with this setup? // Martin

2 7

keep-alive question
by Josh Endries 04 Dec '07

04 Dec '07

I'm having remote connections drop with 1.6. I have my hosts log to localhost stunnel to my server. The problem seems to be when hosts rotate and HUP their daemons, it breaks the stunnel connection. I believe my log server is working after putting keep-alive on it; when I reload it, I don't see messages indicating reconnects. It doesn't on the clients, though, it gave me a syntax error. It seems keep-alive only works in source sections but not in destination sections. Is this correct? The manual online seems to suggest it would work with any tcp stream... (the man page that came with my syslog-ng doesn't mention it at all). Is this different in 2.0? Thanks, J

2 2

destination socket solaris 10 binding failure
by chris cobucci 03 Dec '07

03 Dec '07

Dear users: my first post, so please let me know if I commit some fo-paw. can you let me know if I am mis-configuring something here -- it's my first attempt at using destination sockets: system: sun solaris 10 (sparc) software: syslog-ng.2.0.5 syslog-ng.2.0.6 (no extra-ordinary compile options) /usr/local/etc/syslog-ng.conf (pertinent lines only) destination poe { unix-dgram("/tmp/poeunixsocket"); }; log { source(s_sys); destination(poe); }; socket file is srwxr-xr-w root root 0 poeunixsocket I figured with no listener, ng would just buffer. starting ng (as root) I get: Error binding socket; addr='AF_UNIX(anonymous)', error='Is a directory (21)' Initiating connection failed, reconnecting; time_reopen='10' I've tried unix-stream as well to no avail. Any assistance would be greatly appreciated. Thanks, Chris _________________________________________________________________ Your smile counts. The more smiles you share, the more we donate. Join in. www.windowslive.com/smile?ocid=TXT_TAGLM_Wave2_oprsmilewlhmtagline

2 4

Re: [syslog-ng] File source and flow-control question
by Behal, Pavel 03 Dec '07

03 Dec '07

Dear Bazsi, Attached you can find my configuration file, I used for extensive testing. I have used it as file-incremental transfer agent. Please, ignore Czech comments. Best Regards, Pavel -----Original Message----- Date: Sat, 01 Dec 2007 15:42:19 +0100 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] File source and flow-control question To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1196520139.6678.0.camel(a)bzorp.balabit> Content-Type: text/plain On Fri, 2007-11-30 at 06:44 +0000, Behal, Pavel wrote: > Dear List Members, > > I have found syslog-ng really valuable part of operating system, > thanks to all. I would like to ask a flow-control related question: > > I have tried to use it (2.0.5) also as a collector of events from some > log text-files using the file source with follow-freq set. > It is working fine. But I have realized, that in case of network > problem, the syslog-ng process never stops reading the data. > (Yes, this is normal.) It continuously follows the incremented data > and everything above volume the of internal line buffer get lost. I > hoped, this can be changed using the flow-control flag, but I think > the flow-control flag does not affect the file source and it never > blocks reading. > > Is there any way, how to setup the syslog-ng to stop reading the > followed source file when destination is unavailable and continue from > last event send after reconnect? Thank you. > Hmm.. if flow-control is enabled, syslog-ng should stop reading data from all sources that feed data into the flow-controlled path. Can you post your configuration file? -- Bazsi

2 1

File source and flow-control question
by Behal, Pavel 01 Dec '07

01 Dec '07

Dear List Members, I have found syslog-ng really valuable part of operating system, thanks to all. I would like to ask a flow-control related question: I have tried to use it (2.0.5) also as a collector of events from some log text-files using the file source with follow-freq set. It is working fine. But I have realized, that in case of network problem, the syslog-ng process never stops reading the data. (Yes, this is normal.) It continuously follows the incremented data and everything above volume the of internal line buffer get lost. I hoped, this can be changed using the flow-control flag, but I think the flow-control flag does not affect the file source and it never blocks reading. Is there any way, how to setup the syslog-ng to stop reading the followed source file when destination is unavailable and continue from last event send after reconnect? Thank you. Best Regards, Pavel

2 1

Re: [syslog-ng] Redirect syslog-ng to ttyS0
by kjell.danielsen＠hjemme.no 29 Nov '07

29 Nov '07

Hei. I have included the strace log ( when I log in n ttyS0). Can anyone help me analyzing it. Kjell execve("/sbin/syslog-ng", ["syslog-ng"], [/* 69 vars */]) = 0 brk(0) = 0x80021000 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f79000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=82152, ...}) = 0 mmap2(NULL, 82152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f64000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`5\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=87850, ...}) = 0 mmap2(NULL, 83712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f4f000 madvise(0xb7f4f000, 83712, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f60000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10) = 0xb7f60000 mmap2(0xb7f62000, 5888, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f62000 close(3) = 0 open("/lib/libresolv.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P&\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=74278, ...}) = 0 mmap2(NULL, 76052, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f3c000 madvise(0xb7f3c000, 76052, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f4b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe) = 0xb7f4b000 mmap2(0xb7f4d000, 6420, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f4d000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300Y\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1408371, ...}) = 0 mmap2(NULL, 1181084, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e1b000 madvise(0xb7e1b000, 1181084, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f35000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x119) = 0xb7f35000 mmap2(0xb7f39000, 9628, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f39000 close(3) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e1a000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e1a8c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 mprotect(0xb7f35000, 8192, PROT_READ) = 0 munmap(0xb7f64000, 82152) = 0 brk(0) = 0x80021000 brk(0x80042000) = 0x80042000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f78000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0"..., 4096) = 56 close(3) = 0 munmap(0xb7f78000, 4096) = 0 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfec3f78) = -1 ENOTTY (Inappropriate ioctl for device) fstat64(3, {st_mode=S_IFREG|0644, st_size=5785, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f78000 read(3, "#\n# /etc/syslog-ng/syslog-ng.con"..., 8192) = 5785 read(3, "", 4096) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 open("/etc/nsswitch.conf", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=1185, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f77000 read(4, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1185 read(4, "", 4096) = 0 close(4) = 0 munmap(0xb7f77000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=82152, ...}) = 0 mmap2(NULL, 82152, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb7e05000 close(4) = 0 open("/lib/libnss_compat.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\21\0\000"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=31943, ...}) = 0 mmap2(NULL, 29296, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7f70000 madvise(0xb7f70000, 29296, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f76000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x5) = 0xb7f76000 close(4) = 0 munmap(0xb7e05000, 82152) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=82152, ...}) = 0 mmap2(NULL, 82152, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb7e05000 close(4) = 0 open("/lib/libnss_nis.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260\34"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=41986, ...}) = 0 mmap2(NULL, 37424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7f66000 madvise(0xb7f66000, 37424, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f6e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7) = 0xb7f6e000 close(4) = 0 open("/lib/libnss_files.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360\33"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=42109, ...}) = 0 mmap2(NULL, 37528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7dfb000 madvise(0xb7dfb000, 37528, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7e03000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7) = 0xb7e03000 close(4) = 0 munmap(0xb7e05000, 82152) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=1654, ...}) = 0 mmap2(NULL, 1654, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 1654, [1654], SEEK_SET) = 0 munmap(0xb7e19000, 1654) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=1654, ...}) = 0 mmap2(NULL, 1654, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 1654, [1654], SEEK_SET) = 0 munmap(0xb7e19000, 1654) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=1654, ...}) = 0 mmap2(NULL, 1654, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 1654, [1654], SEEK_SET) = 0 munmap(0xb7e19000, 1654) = 0 close(4) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=831, ...}) = 0 mmap2(NULL, 831, PROT_READ, MAP_SHARED, 4, 0) = 0xb7e19000 _llseek(4, 831, [831], SEEK_SET) = 0 munmap(0xb7e19000, 831) = 0 close(4) = 0 read(3, "", 8192) = 0 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfec39f8) = -1 ENOTTY (Inappropriate ioctl for device) close(3) = 0 munmap(0xb7f78000, 4096) = 0 pipe([3, 4]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e1a908) = 5189 close(4) = 0 read(3, "\0", 1) = 1 exit_group(0) = ?

5 8

Freshmeat page
by Andrej Ricnik-Bay 28 Nov '07

28 Nov '07

Hi, While the announcement on freshmeat says 2.06 the little download icon still points at 2.05. Cheers, Andrej -- Please don't top post, and don't use HTML e-Mail :} Make your quotes concise. http://www.american.edu/econ/notes/htmlmail.htm

3 3

Re: [syslog-ng] syslog-ng 2.0.6 has been released
by G.W. Haywood 28 Nov '07

28 Nov '07

Hi there, On Wed, 28 Nov 2007 BalaBit Development Team wrote: > ------------------------------------------------------------------------------ > PACKAGE : syslog-ng > VERSION : 2.0.6 > SUMMARY : new stable release > DATE : Nov 28, 2007 > ------------------------------------------------------------------------------ > > ... > > SOURCE DOWNLOAD: > > The latest versions of syslog-ng in source format can be found at: > > http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ I don't see 2.0.6 there. -- 73, Ged.

1 0

Has Anyone Gotten Syslog-NG Running as Non-Root Working?
by Mathew Brown 28 Nov '07

28 Nov '07

Hi, I'm currently trying to get syslog-ng running as a non-privileged user. What I've done so far is as follows: * create a sysng user and group * stopped syslog from running * modified /etc/sysconfig/syslog-ng and set SYSLOGNG_OPTIONS to SYSLOGNG_OPTIONS="-p /var/run/syslogd.pid -u sysng -g sysng" * Added the following to my config file: owner(sysng); group(sysng); perm(0600); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) dir_owner(sysng); dir_group(sysng); dir_perm(0700); * Fixed permissions under /var/log as follows: chgrp -R sysng /var/log chmod -R g+wx /var/log * However, my primary problem is reading from /proc/kmsg. It seems that when syslog-ng initially starts, it can open /proc/kmsg before it drops privileges to sysng. Strace shows that it did: 17692 open("/proc/kmsg", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_LARGEFILE) = 3 However, I then find the following in my /var/log/messages file: Nov 28 10:42:37 localhost syslog-ng[18356]: I/O error occurred while reading; fd='3', error='Operation not permitted (1)' So it looks like it can't read from /proc/kmsg. Has anyone gotten this working? I found several related emails but without a resolution to this issue including: * https://lists.balabit.hu/pipermail/syslog-ng/2007-January/009684.html * https://lists.balabit.hu/pipermail/syslog-ng/2007-October/010804.html One possible solution that I'm currently thinking of is to use klogd instead of reading from /proc/kmsg. Any input? Thanks for your help. -- Mathew Brown mathewbrown(a)fastmail.fm -- http://www.fastmail.fm - One of many happy users: http://www.fastmail.fm/docs/quotes.html

1 0

[syslog-ng-announce] syslog-ng 2.0.6 has been released
by BalaBit Development Team 28 Nov '07

28 Nov '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.6 SUMMARY : new stable release DATE : Nov 28, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.6) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.6 Tue, 27 Nov 2007 10:35:27 +0100 IMPORTANT NOTES: * There are two possible Denial of Service fixes in this version of syslog-ng, therefore it is strongly recommended to upgrade to this version. Bugfixes: * HP-UX related build and runtime fixes, backported from the Premium Edition. * If unable to resolve the name of the target host, syslog-ng failed to initialize the TCP/UDP destination drivers. This behavior has been corrected. * Corrected program name parsing in incoming messages. * Fixed a problem in handling messages which lacked explicit timezone information, but the administrator specified a timezone for the messages. * Fixed some minor memory leaks in configuration reloads. * Fixed a segmentation fault which occurred when the timestamp of the incoming messages did not end with a space character (NULL pointer dereference). This is an easy Denial of Service possibility. * Fixed a segmentation fault which occurred when the PID macro was used and the message had a closing bracket (']') before an opening bracket ('['). * Fixed a possible segmentation fault for UDP6/TCP6 destinations. * Fixed IPv6 scope id resolution for link-local addresses. * Solaris related fixes. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ _______________________________________________ syslog-ng-announce mailing list syslog-ng-announce(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng-announce

1 0

Help understanding syslog-ng open-source code
by emanuel 28 Nov '07

28 Nov '07

Hey guys, im trying to implement a few features for the open-source version of syslog-ng. I am going to build my own device driver to better fit my needs. My problem with this task is, that the source code lacks proper commenting and you can easily get lost. Now I wanted to know if theres some special forum or source code documentation and if not, is there someone who is able and willing to answer some questions about the syslog-ng code? This would give my work a huge boost. Thanks for your responses in advance, Emanuel

3 5

[Bug 2] New: program() enhancements
by bugzilla＠bugzilla.balabit.com 27 Nov '07

27 Nov '07

https://bugzilla.balabit.com/show_bug.cgi?id=2 Summary: program() enhancements Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Type of the Report: enhancement Estimated Hours: 0.0 1) make it possible to specify the shell to be used to invoke the program destination 2) instead of restarting the process make it possible to send a signal to it using SIGHUP 3) make it possible to read the output of such programs and interpret it as log messages -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0